Privacy policy

EUROBUS AG (‘We’) is responsible, as controller, for the collection and processing of your personal data in connection with its activities. Our task is to offer our customers a comprehensive range of travel services.

In this privacy policy, we explain how we process your personal data and how you can control and manage it. Our data processing may, where applicable, be covered by further data protection notices, in particular also those contained in the General (Travel) Terms and Conditions, or may result from the circumstances or be regulated by law.

This privacy policy meets the requirements of Swiss data protection law and, where and to the extent applicable, of the General Data Protection Regulation (GDPR) of the European Union.

This privacy policy applies to you if you:

• are one of our customers or have a contractual relationship with us;
• are a fellow traveller of one of our customers.
• are interested in our products or services and therefore provide us with your personal data (e.g. at an agency, on our websites and apps or at events) so that we can contact you.

If you provide us with personal data of other persons, please make sure that you inform them about the disclosure of their personal data and ask them to read this privacy policy. We will ensure that we do the same wherever possible (e.g. where the contact details of the person concerned are available).

You have rights that enable you to effectively control your personal data and the way in which we process it. Below we explain your rights in connection with your personal data.

If you wish to exercise the rights listed below, please submit a request by email to web@eurobus.ch or by post to the following address:

EUROBUS AG
Schwimmbadstrasse 1
5210 Windisch
Switzerland

If you have questions about the use of your personal data under this privacy policy, please direct them to the following address: web@eurobus.ch

2.1 You can request access to your personal data

If you would like access to your personal data, we will provide you with a copy of the personal data you have requested together with information about its processing.

Your right of access may be restricted in the cases provided for by law.

2.2 You can request the rectification of your personal data

If you believe that your personal data is inaccurate or incomplete, you can request that this personal data be amended or completed accordingly. In some cases, supporting documents may be required.

2.3 You can request the erasure of your personal data

If you wish, you can request the erasure of your personal data, to the extent permitted by law.

2.4 You can object to the processing of your personal data on the basis of legitimate interests

If you do not agree with processing based on a legitimate interest, you can object on grounds relating to your individual situation. In that case, please inform us in detail about the processing concerned and the reasons for your objection. We will cease processing your personal data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

2.5 You can object to the processing of your personal data for direct marketing purposes

You have the right to object at any time to the processing of your personal data for direct marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing.

2.6 You can request the restriction of the processing of your personal data

If you dispute the accuracy of the personal data we use or object to the processing of your personal data, we will examine or review your request. You can request that we restrict the processing of your personal data while we examine your request.

2.7 You have rights in relation to automated individual decision-making

In principle, you have the right not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning you or similarly significantly affects you. However, we may automate such a decision if it is necessary for entering into or performing a contract with us, is permitted by legal provisions, or if you have given your consent.

In any case, you have the right to contest the decision, to express your point of view and to request that a competent person intervene to review the decision.

2.8 You can withdraw your consent

In cases where processing is based on consent you have given, you can withdraw that consent at any time.

2.9 You can request the portability of part of your personal data

You can request a copy of the personal data you have provided in a structured, commonly used and machine-readable format. Where technically feasible, you can request that we transmit this copy to a third party.

2.10 Complaint to the Federal Data Protection and Information Commissioner

In addition to the rights listed above, you can lodge a complaint with the competent supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

3.1 Contract performance and legitimate interest

In this section, we explain for what purpose we process your personal data and on what legal basis this is done. First and foremost, we use your personal data to perform a contract to which you are a party or, at your request, to carry out pre-contractual measures. However, we may also process your personal data to fulfil our legitimate interest or that of third parties.

Your personal data is processed in particular where this is necessary for the conclusion or performance of a contract, in order to:

• conclude a (travel) contract with you. We may process personal data in order to register you as a new customer, to conclude a contract and to perform it with you;
• provide you with the products and services that you have purchased under the respective contract;
• carry out accounting, invoicing and debt collection;
• provide you with services in connection with the preparation and conduct of a trip;
• for insurance purposes;
• offer advisory services;
• be able to help in case of need if you encounter difficulties during the trip;
• give you access to our digital platforms. We may process personal data when you use our digital platforms for various purposes (e.g. to manage your personal information or to gain access to travel information);
• to grant access to our premises and facilities. We may process personal data when you visit us at our premises in order to carry out appropriate access and security controls;
• to communicate with you. We may process personal data when you wish to contact us, when you ask us for information about our company or our services, or when the contract needs to be updated;
• respond to your enquiries and support you;
• manage the termination of the contract.

If we base a processing activity on a legitimate interest, we weigh this interest against your interests or fundamental rights and freedoms to ensure that they are in reasonable proportion. In the course of our business activity as a travel provider, we also use your personal data to:

• further develop our products and services;
• improve cybersecurity, manage our platforms and websites and ensure business continuity;
• implement the introduction of IT solutions;
• carry out the maintenance of IT systems during ongoing operations;
• improve the automation and efficiency of our operational processes and our customer services (e.g. automatic completion of complaints, tracking of your enquiries and improvement of your satisfaction on the basis of personal data collected during our interactions with you, e.g. telephone recordings, emails or chats);
• enable the assertion of legal claims and defence in connection with legal disputes and official proceedings;
• organise competitions and promotions and carry out opinion surveys and customer satisfaction surveys.

3.2 Advertising and marketing

If you are a customer and unless you object, we may send you offers for our products and services. We ensure that these commercial offers relate to products or services that are relevant to your needs and complement the offers you have already used. You can object to this at any time.

3.3 Consent

For certain processing of personal data, we will inform you specifically and ask for your consent. Of course, you can withdraw your consent at any time.

In particular, we ask for your consent for:

• The transmission of sensitive personal data to third parties;
• A tailor-made adaptation of our offers and products or services on the basis of a complex profile in order to predict your needs and your behaviour;
• all electronic offers for products and services that are not similar to those you have purchased, or for products and services from our trusted partners.

Where necessary, we may ask you for further consent to the processing of your personal data, which, however, has no effect on data processing that has already taken place.

We collect and use your personal data, i.e. all information that identifies you or makes it possible to identify you.

Depending on the type of product or service that we offer you and the interactions that we have with you, we collect various types of personal data about you:

• Contact information, (private or business) postal address, email address, telephone number;
• Personal details, e.g. gender, date of birth and age, marital status, nationality, passport details, etc.
• Lifestyle, e.g. hobbies and interests, travel;
• Travel details, such as travel dates, itinerary/destination, airline, hotel, price, customer requests, information about your fellow travellers, frequent flyer programmes, etc.;
• Health data, e.g. information about health-related special needs or illnesses and accidents during a trip;
• Financial details, e.g. payment information, credit card number, account details;
• Data about your habits and preferences in relation to the use of our products and services (e.g. meal requests);
• Data from our interactions with you, e.g. your comments, suggestions, needs collected during our exchanges with you in person at our locations and during telephone communication (call note or call recording), communication by email, chat, chatbot, exchanges on our social media and any complaints you may have. Your connection and tracking data (e.g. collected via cookies for non-advertising or analytical purposes on our websites), online services, other applications;
• Data about your devices (mobile phone, computer, tablet, etc.), such as IP address, technical data and unique identification data;
• Personalised login data or security features used to connect you to our website and apps.

We generally collect personal data directly from you. However, we may also collect it from other sources.

Sometimes we collect data from public sources:

• publications/databases made available by official authorities or third parties (e.g. the Swiss Official Gazette of Commerce or the commercial register);
• websites/social media presences of legal entities or corporate customers containing information that you have disclosed (e.g. your own website or your social media presence);
• public information, e.g. information from the media.

We also collect personal data from third parties:

• from our customers (e.g. as fellow travellers);
• from our business partners (e.g. tour operators, service providers abroad);
• from third parties such as credit reference agencies and fraud prevention agencies;
• from address research service providers, who are themselves responsible for collecting the relevant information lawfully.

In order to fulfil some of the purposes described in this privacy policy, in particular the conduct of a trip, we may, where appropriate, disclose your personal data to others. These may be the following:

• Our service providers in the destination country (e.g. agencies, tour guides, hotel reservation, transfer and excursion services), transport service providers (airline, train, car hire, etc.) and accommodation operators (hotel, hostels, etc.);
• Processors that provide services on our behalf (e.g. IT services, logistics, printing services, telecommunications, debt collection, consulting and sales, and marketing);
• certain regulated professions such as lawyers, notaries or auditors, where this is necessary in certain circumstances (legal disputes, audits, etc.) and to our insurers;
• partners for carrying out advertising, market and opinion research;
• partners for assistance in investigating criminal offences (e.g. fraud), and in asserting, exercising or defending legal claims;
• authorities and official bodies (e.g. tax authorities, embassies of the destination country) where there is a statutory or official obligation (e.g. retention obligations, obtaining visas, obtaining entry requirements).

International transfers from Switzerland and the European Economic Area (EEA) to a non-EEA country (third country) may involve the cross-border transfer of your personal data. You must in particular expect your data to be transferred to your countries of travel. But also to countries in Europe, the USA and worldwide, where the service providers and suppliers we use are located. If the FDPIC or the European Commission has recognised that a third country offers an adequate level of data protection, your personal data may be transferred on that basis.

For transfers to a third country whose level of protection has not been recognised as adequate by the FDPIC and the European Commission, we rely either on an exception applicable to the particular situation (e.g. where the transfer is necessary for the performance of our contract with you) or we apply one of the following appropriate safeguards to ensure the protection of your personal data:

• standard contractual clauses approved by the FDPIC and the European Commission;
• binding corporate rules.

To obtain a copy of these safeguards or information on where they are available, you can submit a written request in accordance with section 2.

We will retain your personal data for as long as is necessary to fulfil our contractual obligations and to comply with applicable laws and regulations, or for another period with regard to our legitimate business interests, such as proper bookkeeping and responding to legal claims or official enquiries.

We use appropriate technical and organisational security measures to protect the personal data stored with us against manipulation, partial or complete loss and unauthorised access by third parties (e.g. encryption of data transmission, access controls, etc.). Our security measures are continuously improved in line with technological developments.

We take reasonable precautions to protect your data. The transmission of information over the internet and other electronic means always involves certain security risks, and we cannot guarantee the security of information transmitted in this way.

In a world in which technologies are constantly evolving, we review this privacy policy regularly and update it where necessary.

The current version published on our website applies in each case. We recommend that you view the latest version of this document online. We will inform you of changes via our website or through our usual communication channels.

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses so-called ‘cookies’. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there.

Google Analytics cookies are stored on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its web offering and its advertising.

IP anonymisation

We have activated the IP anonymisation function on this website. As a result, your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services relating to website use and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

Browser plugin

You can prevent the storage of cookies by setting your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie and relating to your use of the website (including your IP address) by Google, and the processing of this data by Google, by downloading and installing the browser plugin available at the following link: browser add-on to opt out of Google Analytics.

Objection to data collection

More information on how Google Analytics handles user data can be found in Google’s privacy policy: data protection in Google Analytics.

Commissioned data processing

We have concluded a commissioned data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Demographic characteristics in Google Analytics

This website uses the ‘demographic characteristics’ function of Google Analytics. This makes it possible to create reports containing statements about the age, gender and interests of site visitors. This data comes from interest-based advertising by Google and from visitor data from third-party providers. This data cannot be attributed to a specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as described in the section ‘Objection to data collection’.

Google Analytics Remarketing

Our websites use the functions of Google Analytics Remarketing in conjunction with the cross-device functions of Google AdWords and Google DoubleClick. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This function makes it possible to link the advertising audiences created with Google Analytics Remarketing to the cross-device functions of Google AdWords and Google DoubleClick. In this way, interest-based, personalised advertising messages that have been tailored to you depending on your previous usage and browsing behaviour on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC).

If you have given the corresponding consent, Google links your web and app browsing history to your Google account for this purpose. In this way, the same personalised advertising messages can be delivered on every device on which you log in with your Google account.

To support this function, Google Analytics collects Google-authenticated IDs of users, which are temporarily linked to our Google Analytics data in order to define and create audiences for cross-device advertising.

You can permanently object to cross-device remarketing/targeting by deactivating personalised advertising in your Google account; follow this link: Google personalised advertising settings.

The consolidation of the data collected in your Google account takes place exclusively on the basis of your consent, which you can give or withdraw with Google (Art. 6 para. 1 lit. a GDPR). In the case of data collection processes that are not merged in your Google account (e.g. because you do not have a Google account or have objected to the merging), the collection of the data is based on Art. 6 para. 1 lit. f GDPR. The legitimate interest arises from the fact that the website operator has an interest in the anonymised analysis of website visitors for advertising purposes.

Further information and the data protection provisions can be found in Google’s privacy policy at: Google’s information on advertising.

Newsletter data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and agree to receive the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The data entered in the newsletter registration form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw your consent to the storage of the data and the email address and to their use for sending the newsletter at any time, for example via the ‘unsubscribe’ link in the newsletter. The lawfulness of the data processing operations that have already taken place remains unaffected by the withdrawal.

The data you have deposited with us for the purpose of receiving the newsletter is stored by us until you unsubscribe from the newsletter and is deleted after the newsletter has been cancelled. Data that has been stored with us for other purposes (e.g. email addresses for the members’ area) remains unaffected by this.

YouTube

Our website uses plugins from the YouTube site, which is operated by Google. The operator of the sites is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

If you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. In the process, the YouTube server is informed which of our pages you have visited.

If you are logged in to your YouTube account, you enable YouTube to assign your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used in the interest of an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

Further information on how user data is handled can be found in the Google privacy policy (YouTube).

Google Web Fonts

To ensure uniform display of fonts, this site uses so-called web fonts provided by Google. When you open a page, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly.

For this purpose, the browser you use must connect to Google’s servers. As a result, Google becomes aware that our website was accessed via your IP address. Google Web Fonts is used in the interest of a uniform and appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

If your browser does not support web fonts, a standard font from your computer is used.

Further information on Google Web Fonts can be found in the Google Fonts FAQ and in the Google privacy policy.

Google Maps

This site uses the map service Google Maps via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.

Google Maps is used in the interest of an appealing presentation of our online offerings and to make the places indicated on the website easy to find. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

More information on the handling of user data can be found in the Google privacy policy.

AI assistant

On the pages of our business areas, we offer a chat with an artificial intelligence (AI) assistant at the bottom right. The assistant is a computer programme, not a person: a language model answers your questions automatically, based on the content of our website and our travel offers, and puts you in touch with our advisers if needed. Its answers may be incomplete or wrong; the information in the trip description, your quotation and your booking confirmation is authoritative. The assistant does not accept bookings and does not make any decisions about you (section 2.7). Using it is voluntary; you can also reach us by telephone, by email or through our forms.

Transfer to Anthropic

To answer, we use the language model Claude by Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland, and Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA). For each answer, we send Anthropic:

• your question, exactly as you entered it;
• the most recent messages of the conversation so far (your questions and the assistant’s answers);
• relevant content from our website and our travel offers.

The request to Anthropic is sent by our server. Anthropic does not receive your IP address, cookies or any other identifiers of your device.

Purpose and legal basis

We process this data to answer your question and, if you wish, to put you in touch with our advisers, to improve the assistant and our website, and to prevent misuse. Where the GDPR applies, we rely on Art. 6 para. 1 lit. b GDPR (answering your enquiry before a possible contract) and on Art. 6 para. 1 lit. f GDPR (our legitimate interest in providing information quickly, improving our services and protecting against misuse). You can object to this processing (section 2.4).

Anthropic as processor, transfer to the USA

Anthropic processes the data on our behalf and under its terms for commercial customers, including in the USA. This transfer is covered by the European Commission’s standard contractual clauses, with the additions for Switzerland, which form part of Anthropic’s data processing addendum (see section 7). Under these terms, Anthropic may not use your questions or the answers to train its language models. Anthropic keeps them only for a limited period and then deletes them automatically; for longer only where this is necessary to enforce its usage policy or required by law. Details: Commercial Terms of Service, Data Processing Addendum and Anthropic’s privacy information.

What EUROBUS stores

We do not store conversations. The conversation history is kept only in your browser’s memory (sessionStorage) so that the conversation continues when you change pages. With each new question, your browser sends it to our server, which passes it on to Anthropic without keeping it. It is deleted when you close the browser tab or window or start a new conversation.

To improve the assistant and our website, we keep a log of questions. For each question it contains:

• the text of the question (up to 300 characters);
• the business area, the language and the time;
• whether it was the first question of the conversation, whether matching content was found, whether the answer came from the cache and which search functions the assistant used;
• the size of the request to the language model, the cost and the response time.

Before storing, we automatically replace the following with placeholders: email addresses; telephone, card and account numbers; and names you introduce with phrases such as “My name is …” or “I am …”. This detection does not catch everything. The log contains neither your IP address nor a session or cookie identifier nor the assistant’s answer; as a rule, we therefore cannot link the entries to any person. The entries are deleted after 180 days.

Answers to the questions we suggest for you to click on in the chat are cached for no more than 6 hours so that they appear immediately. Only the answer to these predefined questions is cached, never anything you have entered yourself; these entries contain no data about you and are deleted during the daily clean-up once they have expired.

Protection against misuse

To prevent misuse and overload, we limit requests per internet connection per minute, per day and at the same time. For this purpose, we use a secret key to derive a checksum from your IP address (for IPv6, from the address range of your connection), from which the IP address cannot be determined without this key; we do not store the IP address itself for this purpose. The counters expire after one day at the latest and are deleted during the daily clean-up.

Please do not enter personal data

Please do not enter any personal data in the chat, such as names, addresses, telephone numbers, dates of birth, health or payment details: Anthropic receives what you enter unchanged. For a booking or personal advice, please use our forms or contact us directly. If you have questions about the AI assistant or data protection, please write to web@eurobus.ch.